What is GHSA-87hf-473v-8h9c?

GHSA-87hf-473v-8h9c is a security advisory published by GitHub Security Advisories with Medium severity. Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per...

Which CVE IDs does GHSA-87hf-473v-8h9c cover?

GHSA-87hf-473v-8h9c covers the following CVE IDs: CVE-2026-73632. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-87hf-473v-8h9c?

GHSA-87hf-473v-8h9c has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-87hf-473v-8h9cMediumCVSS 4.3

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per...

Vendor

GitHub Security Advisories

Published

August 15, 2026

Last Modified

August 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-73632 →

📋 Description

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.

This issue affects Apache Struts: 7.2.1.

Users are recommended to upgrade to version 7.3.0, which fixes the issue.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-73632
https://cwiki.apache.org/confluence/display/WW/S2-071
https://github.com/advisories/GHSA-87hf-473v-8h9c